libnetwork/d/overlay: make setupEncryption a method

corhere · corhere · commit cb4e7b2f0392 · 2025-05-29T14:13:13.000-04:00
The setupEncryption and removeEncryption functions take several
parameters, but all call sites pass the same values for all the
parameters aside from remoteIP: values taken from fields of the driver
struct. Refactor these functions to be methods of the driver struct and
drop the redundant parameters.

Signed-off-by: Cory Snider &lt;csnider@mirantis.com&gt;
diff --git a/libnetwork/drivers/overlay/encryption.go b/libnetwork/drivers/overlay/encryption.go
@@ -129,8 +129,6 @@ func (d *driver) checkEncryption(nid string, rIP netip.Addr, add bool) error {
 		return types.ForbiddenErrorf("encryption key is not present")
 	}
 
-	lIP := d.bindAddress
-	aIP := d.advertiseAddress
 	nodes := map[netip.Addr]struct{}{}
 
 	switch {
@@ -153,14 +151,14 @@ func (d *driver) checkEncryption(nid string, rIP netip.Addr, add bool) error {
 
 	if add {
 		for rIP := range nodes {
-			if err := setupEncryption(lIP, aIP, rIP, d.secMap, d.keys); err != nil {
-				log.G(context.TODO()).Warnf("Failed to program network encryption between %s and %s: %v", lIP, rIP, err)
+			if err := d.setupEncryption(rIP); err != nil {
+				log.G(context.TODO()).Warnf("Failed to program network encryption to remote peer %s: %v", rIP, err)
 			}
 		}
 	} else {
 		if rIP.IsValid() && len(nodes) == 0 {
-			if err := removeEncryption(lIP, rIP, d.secMap); err != nil {
-				log.G(context.TODO()).Warnf("Failed to remove network encryption between %s and %s: %v", lIP, rIP, err)
+			if err := d.removeEncryption(rIP); err != nil {
+				log.G(context.TODO()).Warnf("Failed to remove network encryption to remote peer %s: %v", rIP, err)
 			}
 		}
 	}
@@ -170,7 +168,9 @@ func (d *driver) checkEncryption(nid string, rIP netip.Addr, add bool) error {
 
 // setupEncryption programs the encryption parameters for secure communication
 // between the local node and a remote node.
-func setupEncryption(localIP, advIP, remoteIP netip.Addr, em *encrMap, keys []*key) error {
+func (d *driver) setupEncryption(remoteIP netip.Addr) error {
+	localIP, advIP := d.bindAddress, d.advertiseAddress
+	keys := d.keys // FIXME: data race
 	log.G(context.TODO()).Debugf("Programming encryption between %s and %s", localIP, remoteIP)
 
 	indices := make([]*spi, 0, len(keys))
@@ -195,17 +195,17 @@ func setupEncryption(localIP, advIP, remoteIP netip.Addr, em *encrMap, keys []*k
 		}
 	}
 
-	em.Lock()
-	em.nodes[remoteIP] = indices
-	em.Unlock()
+	d.secMap.Lock()
+	d.secMap.nodes[remoteIP] = indices
+	d.secMap.Unlock()
 
 	return nil
 }
 
-func removeEncryption(localIP, remoteIP netip.Addr, em *encrMap) error {
-	em.Lock()
-	indices, ok := em.nodes[remoteIP]
-	em.Unlock()
+func (d *driver) removeEncryption(remoteIP netip.Addr) error {
+	d.secMap.Lock()
+	indices, ok := d.secMap.nodes[remoteIP]
+	d.secMap.Unlock()
 	if !ok {
 		return nil
 	}
@@ -214,7 +214,7 @@ func removeEncryption(localIP, remoteIP netip.Addr, em *encrMap) error {
 		if i == 0 {
 			dir = bidir
 		}
-		fSA, rSA, err := programSA(localIP.AsSlice(), remoteIP.AsSlice(), idxs, nil, dir, false)
+		fSA, rSA, err := programSA(d.bindAddress.AsSlice(), remoteIP.AsSlice(), idxs, nil, dir, false)
 		if err != nil {
 			log.G(context.TODO()).Warn(err)
 		}

Original file line number	Diff line number	Diff line change
`@@ -129,8 +129,6 @@ func (d *driver) checkEncryption(nid string, rIP netip.Addr, add bool) error {`
`129`	`129`	`return types.ForbiddenErrorf("encryption key is not present")`
`130`	`130`	`}`
`131`	`131`
`132`		`- lIP := d.bindAddress`
`133`		`- aIP := d.advertiseAddress`
`134`	`132`	`nodes := map[netip.Addr]struct{}{}`
`135`	`133`
`136`	`134`	`switch {`
`@@ -153,14 +151,14 @@ func (d *driver) checkEncryption(nid string, rIP netip.Addr, add bool) error {`
`153`	`151`
`154`	`152`	`if add {`
`155`	`153`	`for rIP := range nodes {`
`156`		`- if err := setupEncryption(lIP, aIP, rIP, d.secMap, d.keys); err != nil {`
`157`		`- log.G(context.TODO()).Warnf("Failed to program network encryption between %s and %s: %v", lIP, rIP, err)`
	`154`	`+ if err := d.setupEncryption(rIP); err != nil {`
	`155`	`+ log.G(context.TODO()).Warnf("Failed to program network encryption to remote peer %s: %v", rIP, err)`
`158`	`156`	`}`
`159`	`157`	`}`
`160`	`158`	`} else {`
`161`	`159`	`if rIP.IsValid() && len(nodes) == 0 {`
`162`		`- if err := removeEncryption(lIP, rIP, d.secMap); err != nil {`
`163`		`- log.G(context.TODO()).Warnf("Failed to remove network encryption between %s and %s: %v", lIP, rIP, err)`
	`160`	`+ if err := d.removeEncryption(rIP); err != nil {`
	`161`	`+ log.G(context.TODO()).Warnf("Failed to remove network encryption to remote peer %s: %v", rIP, err)`
`164`	`162`	`}`
`165`	`163`	`}`
`166`	`164`	`}`
`@@ -170,7 +168,9 @@ func (d *driver) checkEncryption(nid string, rIP netip.Addr, add bool) error {`
`170`	`168`
`171`	`169`	`// setupEncryption programs the encryption parameters for secure communication`
`172`	`170`	`// between the local node and a remote node.`
`173`		`-func setupEncryption(localIP, advIP, remoteIP netip.Addr, em encrMap, keys []key) error {`
	`171`	`+func (d *driver) setupEncryption(remoteIP netip.Addr) error {`
	`172`	`+ localIP, advIP := d.bindAddress, d.advertiseAddress`
	`173`	`+ keys := d.keys // FIXME: data race`
`174`	`174`	`log.G(context.TODO()).Debugf("Programming encryption between %s and %s", localIP, remoteIP)`
`175`	`175`
`176`	`176`	`indices := make([]*spi, 0, len(keys))`
`@@ -195,17 +195,17 @@ func setupEncryption(localIP, advIP, remoteIP netip.Addr, em encrMap, keys []k`
`195`	`195`	`}`
`196`	`196`	`}`
`197`	`197`
`198`		`- em.Lock()`
`199`		`- em.nodes[remoteIP] = indices`
`200`		`- em.Unlock()`
	`198`	`+ d.secMap.Lock()`
	`199`	`+ d.secMap.nodes[remoteIP] = indices`
	`200`	`+ d.secMap.Unlock()`
`201`	`201`
`202`	`202`	`return nil`
`203`	`203`	`}`
`204`	`204`
`205`		`-func removeEncryption(localIP, remoteIP netip.Addr, em *encrMap) error {`
`206`		`- em.Lock()`
`207`		`- indices, ok := em.nodes[remoteIP]`
`208`		`- em.Unlock()`
	`205`	`+func (d *driver) removeEncryption(remoteIP netip.Addr) error {`
	`206`	`+ d.secMap.Lock()`
	`207`	`+ indices, ok := d.secMap.nodes[remoteIP]`
	`208`	`+ d.secMap.Unlock()`
`209`	`209`	`if !ok {`
`210`	`210`	`return nil`
`211`	`211`	`}`
`@@ -214,7 +214,7 @@ func removeEncryption(localIP, remoteIP netip.Addr, em *encrMap) error {`
`214`	`214`	`if i == 0 {`
`215`	`215`	`dir = bidir`
`216`	`216`	`}`
`217`		`- fSA, rSA, err := programSA(localIP.AsSlice(), remoteIP.AsSlice(), idxs, nil, dir, false)`
	`217`	`+ fSA, rSA, err := programSA(d.bindAddress.AsSlice(), remoteIP.AsSlice(), idxs, nil, dir, false)`
`218`	`218`	`if err != nil {`
`219`	`219`	`log.G(context.TODO()).Warn(err)`
`220`	`220`	`}`